I am currently working on a project, and we are exploring different types of current industry MFA standards. The most known ones would most likely be HOTP & TOTP pins, which are used in the 'Google Authenticator' app or send by separate web services via SMS to a users phone.

What stops anyone from changing this standard? It seems the only reasons are that no internet connection is required on your phone to get the pin via app, and that it could be sent over SMS if your phone can't run apps (lol).

But there are also a few Cons. For one, the pin can be seen on most phones even when the screen is still locked. In addition, anyone looking at your phone can jump over this entire security layer. The first would be something you know, and the second would be something you have, which usually is a smartphone, but that extra layer is nullified if someone can just steal your phone for a second to look at it (like in the first season of House of Cards)!

So my question would be, are there any other pros and cons that keep this the current standard, or is it one of those situations where the process is just so simple and straight forward that the ease-of-use outweighs the need for improvement?

Also: What would the downside be of a process that uses an active internet connection on your phone to request a pin vs. having the pin generated based on a time value (TOTP)?

  • 1
    Smart phone 2fa solutions are intended to prevent a net-based attack and not the theft of a phone and associated account. – Neil Smithline Jun 2 '16 at 20:06
  • So it is basically just secure 'enough' for it's current purpose? – PositriesElectron Jun 2 '16 at 20:09
  • it solved the problem of preventing mass breaches of free and cheap services in a low cost manner. Hardware based security is great, but costly. How could a free service like Google offer that? – Neil Smithline Jun 2 '16 at 20:11

So one thing you're getting confused about is that you're combining to different security theaters. Let's instead look purely at the web, and then purely at the phone.

The Web Theater

With the web you're subject to people randomly trying to hack your account. This is protected by a password(something you know) and a username(something you have). In this case if anyone gets the username they can start attacking you and eventually get your account.

Now lets add a second password. YAY! Now they have twice the entropy. But it's still something you know(static). Instead lets change that password to something dynamic. Now EVERY time that dynamic one changes they have to start over because they have to retry every dynamic code and password combination in existence yet again.

That's just not worth it to try and break into. You would only DDOS a server, and if the server is setup correctly then you can't DDOS it.

The Phone End

Okay so now someone has your username, and phone, and you're locked up in a basement... and they've beaten you until you have given them the passwords... and you're just crying and hoping the police show up and save you...

The truth of the matter is that the given part(on your phone) is kept physically secure by you. If you have a worry about physical safety, you should probably already be in the steps of doing something about it(like not lending it out, not displaying notification content on your lock screen(an option on most smartphones), and if you do receive it over SMS and someone sees it, all they see is a string. They don't know what it's for.

If they do know what it is for however then you've already been pwned because they know your username. If someone else knows your username you're doing something else wrong, and this isn't the problem. Your own physical habits are.

What about active connection pins?

The problem is the phone is making the communication, and as such if someone is listening to the phone and performs a MITM on just the phone, they can get access to the account. Generation without communication is much safer because someone can't listen to it. They would have had to have been listening to the initial setup(again separated without communication) to have gotten the pin to generate the time sensitive code. Again that comes into the tied up in a basement scenario. There I'd be much more worried about my physical safety than my account safety.

What about generated codes?

What if I look at a phone and see '8675309 sent 98jdff712hfg' on the screen? What does it mean? I don't know what service that number(usually from a pool of numbers that rotates randomly or is used by many services) is associated with. The only way this would have made sense is if I was sitting over your shoulder and watching the ENTIRE login process. Again that's something much more terrifying and you'd probably be looking out for it as you enter the data.

|improve this answer|||||

Your Answer

